Your AI reads the internet.
The internet can tell it what to do.
Prompt injection is the top-ranked risk to LLM applications, and it does not arrive through your chat box. It hides in a web page, an email, a PDF, a tool response — anything your model is asked to read. Then it acts with your model’s permissions.
live demonstration
The same attack, against two architectures
Below is a real payload from the battery, running against a sandboxed toy model that is holding a throwaway secret. Watch the unprotected one hand it over. Then flip the toggle and watch the structural fix hold — same input, no change to the wording.
IND-001 A summariser is pointed at an article. The instruction is in an HTML comment.
1 — what the model is asked to read
The highlighted text is invisible to the human reader. The model sees it as instruction.
2 — what came back
your turn — try to make it leak
The model below is holding a throwaway secret. Write anything you like and try to get it out. It is a sandboxed toy — no real keys, no real model, nothing to break.
the honest part
Your system prompt will not save you
The market is full of “jailbreak-proof prompts” and master instructions sold as protection. We are not selling you one, because they do not work — and anyone telling you otherwise is selling theatre.
Injection does not live in your prompt. It lives in the data your model is told to trust. A model cannot reliably separate “instruction from my operator” from “instruction inside the document I was asked to summarise”, because both arrive as text in the same context. Every published unbreakable prompt gets broken, usually within days.
What actually holds is structural. The model that reads untrusted content gets no tools and no secrets; a separate step decides what to do. Rendered output is constrained so a leak has nowhere to go. Consequential actions sit behind a gate the model cannot talk its way past.
what we measured
| Reference target | Resistance | Failed |
|---|---|---|
| No defences | 2/100 | 42 |
| Quarantine architecture | 100/100 | 0 |
Identical 46-payload battery against both, including 13 critical findings on the undefended one. The delta is architecture — not prompt wording, and not a filter.
what you actually get
A measurement, and the fixes that follow from it
The battery
46 payloads across 5 classes — direct override, obfuscation and encoding, indirect injection through content you ingest, exfiltration side-channels, and agentic tool abuse. Each one cites the technique it implements.
The scored report
A resistance score, per-class breakdown, and every payload’s verdict — as self-contained HTML you can forward to a CISO, plus JSON for your pipeline. Anything a string match cannot settle is marked needs review rather than quietly passed.
The hardening playbook
The structural layers, in the order worth doing them, mapped to the classes you actually failed. Reference prompts appear as one layer among several — never as the whole answer.
it runs where you run it
# your keys never touch our servers
pip install -r requirements.txt
python3 scanner/scanner.py \
--endpoint https://your-app.com/api/chat \
--response-field choices.0.message.content \
--header "Authorization: Bearer $KEY" --html report.htmlNon-zero exit on any failure, so it drops straight into CI as a gate.
pricing
Start free. Pay when you want the full battery.
The free scan is genuinely useful and needs no card. The paid tiers exist because the corpus keeps moving — new attack classes land, and resistance rots between releases.
Free scan
See whether the obvious attacks already work on you.
- 8 payloads from the public subset
- Pass / fail summary
- Runs on your machine — keys never leave it
- No account, no card
Audit report
The full battery, scored, with the fixes that actually hold.
- All 46 payloads across 5 attack classes
- Scored HTML + JSON report you can forward
- Remediation ranked by what is actually exploitable
- The hardening playbook
- Corpus updates for 12 months
Re-test
Injection resistance rots. Catch the regression, not the incident.
- Everything in the audit
- Scheduled re-runs as the corpus grows
- CI gate — non-zero exit on any new failure
- Diff against your last run
- Alert when a new attack class lands
Agency
Audit your clients and put your own name on the report.
- Unlimited endpoints and clients
- White-label reports
- API access
- Priority corpus requests